NetApp AltaVault AVA400, Руководство администратора

Страница: 108 / 276

108 NetApp AltaVault Cloud Integrated Storage Administration Guide
Beta Draft
Configuring AltaVault appliances for FIPS-compliant cryptography Configuring AltaVault appliances for FIPS-compliant cryptography
Cipher requirements
You need to use the following cipher string when running in FIPS mode: TLSv1.2:kRSA:!eNULL:!aNULL
This requirement impacts SSL optimization, secure peering, and the Web interface security settings.
Note: It is advisable to allow TLS 1.1 or TLS 1.2.
To configure the cipher

Enter the command web ssl cipher.
The format of the command is:
web ssl cipher TLSv1.2:kRSA:!eNULL:!aNULL
If you do not configure the required cipher string, the following message appears after enabling FIPS mode or with the
show fips status
command:
Web SSL ciphers must include the elements in TLSv1.2:kRSA:!eNULL:!aNULL and may optionally
delete ciphers.
This message also appears if you make any changes to the Web SSL cipher.
Key size requirements
FIPS specifies three techniques for the generation and verification of digital signatures for the protection of data: the
Digital Signature Algorithm (DSA), the Elliptic Curve Digital Signature Algorithm (ECDSA), and the Rivest-Shamir-
Adleman (RSA) Algorithm.
FIPS includes key size requirements when running in FIPS mode. All imported and generated keys need to be the
following sizes:

RSA-based and DSA-based certificates:
– 2048 bits
– 3072 bits
– 4096 bits

ECDSA certificates:
– 224 bits and higher
These requirements apply to SSL optimization, SSL secure peering, and the Web interface.
Web user interface
You need to ensure imported and generated certificates for the Web interface adhere to FIPS size requirements and use
only 2048-bit or higher key sizes.
You manage Web interface certificate keys using the web ssl cert generate key-size * command in the CLI and the
Configure > Web Settings page in the Management Console. These methods always generate RSA based self-signed
certificates.
In addition to self-signed certificates, you can import certificates using the web ssl cert import-cert * and web ssl cert
import-cert-key * commands or the Configure > Web Settings page in the Management Console.